Connect a single SAG device with one-arm dynamic routing

Network plan

The following table shows an example network plan. If you plan your own network, ensure the CIDR blocks do not overlap.

Workflow

Step 1: Purchase an SAG device

After you purchase an SAG device on the SAG console, Alibaba Cloud ships the device to you and creates an SAG instance for device management.

1. Log on to the Smart Access Gateway console.

2. On the Smart Access Gateway page, click Purchase SAG.

3. Select Create SAG (CPE).

4. On the Smart Access Gateway page, set the following parameters, and then click Buy Now.

   • Region: The region where the SAG device is used. In this example, select Mainland China.

   • Instance Type: The model of the SAG device. In this example, select SAG-1000.

   • Have SAG Hardware Already: Select whether you already have an SAG device. In this example, select No.

   • Version: The edition of the SAG device. This example uses the default Standard Edition edition.

   • Quantity: The number of SAG devices to purchase. In this example, select 1.

   • Region: The bandwidth region used by the Smart Access Gateway (SAG) device. This region is the same as the region of the SAG device and cannot be modified.

   • Instance Name: The name of the SAG instance.

   • Peak Bandwidth: The peak bandwidth of the network. In this example, select 50 Mbps.

   • Subscription Period: Select a subscription duration.

5. Confirm the order information, select the terms of service, and then click Confirm Purchase.

6. In the Receiving Address dialog box, enter your shipping address, and then click Buy Now.

7. On the Pay page, select a payment method and complete the payment.

8. You can check whether the order is placed on the Smart Access Gateway page. SAG devices will be shipped within two business days after you place the order. To check the shipping updates, perform the following operations:

   1. On the Smart Access Gateway page, find the target SAG instance.

   2. In the Operation column, click the icon and select View Shipping Update.

   3. In the Order Updates panel, view the shipping updates.

After the order is placed, the SAG instance status changes to Pending Shipment.

Step 2: Activate and connect the SAG device

After you receive the SAG device, verify that all accessories are included. For more information, see SAG-1000 device specifications.

After verifying the device, activate and connect it.

1. Log on to the Smart Access Gateway console.

2. In the top navigation bar, select the region where your SAG instance is deployed.

3. On the Smart Access Gateway page, find the target instance and bind the device to the SAG instance. For more information, see Add a device.

4. After the device is bound, return to the Smart Access Gateway page. In the Operation column of the target instance, click > Activate.

5. In the Activate dialog box, click OK.

6. After the device is activated, connect the SAG device to your on-premises network as shown in the topology diagram.

   Use a network cable to connect the WAN port of the SAG device to port G11 of the Layer 3 switch.

   This example uses the WAN port (Port 5). If Port 5 on your device is not a WAN port, you can change the port role. For more information, see Assign port roles.

   Note

   • Only SAG-1000 V2.0 devices support port role assignment.

   • Before you assign port roles, make sure that the SAG device is powered on, has a stable 4G signal, and is connected to Alibaba Cloud.

Step 3: Configure the SAG device

After connecting the device, configure its ports and routes on the SAG console. Make sure the SAG device is powered on, has a stable 4G signal, and is connected to Alibaba Cloud.

1. Configure the device port.

   1. Log on to the Smart Access Gateway console.

   2. In the top navigation bar, select the region where your SAG instance is deployed.

   3. On the Smart Access Gateway page, click the ID of the target instance.

   4. On the instance details page, click the Device Settings tab.

   5. In the left-side navigation pane of the Device Settings tab, click Manage WAN Ports.

   6. In the WAN (Port 5) section, click Edit.

   7. In the WAN (Port 5) Configuration dialog box, configure the port with the following information, and then click OK.

      • Connection Type: Select Static IP.

      • Priority: Use the default value 1.

      • IP Address: The IP address of the WAN port. In this example, enter 192.168.100.1.

      • Mask: The subnet mask for the WAN port's IP address. In this example, enter 255.255.255.252.

      • Gateway: The gateway IP address. In this example, enter 192.168.100.2.

        Note

        After you configure the gateway, the SAG device automatically adds a default route.

2. Configure the OSPF dynamic routing protocol.

   OSPF establishes a communication channel between the SAG device and the Layer 3 switch.

   1. In the left-side navigation pane of the Device Settings tab, click Manage Routes.

   2. In the OSPF Protocol Settings section, click Edit.

   3. On the Configure OSPF Protocol page, configure the parameters as planned, and then click OK.

      Parameter	Description
      Area ID	Area ID: 1
      Hello_time	3 seconds
      Dead_time	10 seconds
      Authentication Method	Select No Authentication.
      Router ID	Router ID: 192.168.100.1
      Area Type	The area type is NSSA by default.

   4. In the Dynamic Routing Settings section, select Enable OSPF Protocol.

   5. In the row for Port 5 (WAN), click Edit in the Operation column, select Enable OSPF, and then click OK.

3. Configure the method to synchronize on-premises routes.

   Configure how on-premises routes are synchronized to Alibaba Cloud so that your on-premises network can communicate with cloud resources.

   1. On the instance details page, click the Network Configuration tab.

   2. In the left-side navigation pane, click Method to Synchronize with On-premises Routes.

   3. Select Static Routing, click Add Static Route, configure the static route, and then click OK.

      Add a static route for the on-premises service CIDR block (172.16.0.0/12).

Step 4: Configure the switch and egress router

Configure routes on the peer Layer 3 switch and egress router. The following configurations are vendor-specific and may differ for your devices. For details, refer to your device documentation.

1. Configure the Layer 3 switch.

   #a. Configure port IP and OSPF parameters:
   interface GigabitEthernet 0/11
   no switchport
   ip ospf network point-to-point                        # The network type for the interface that connects to the SAG device and runs OSPF must be configured as P2P. Otherwise, routes cannot be correctly calculated. 
   ip ospf hello-interval 3
   ip ospf dead-interval 10
   ip address 192.168.100.2 255.255.255.252
   #b. Configure the switch's loopback address and route advertisement information: 
   interface Loopback 0
   ip address 192.168.100.3 255.255.255.255                # The loopback address of the switch. 
   router ospf 1                                           # Configure the OSPF protocol on the switch and advertise routes.
   router-id 192.168.100.3                               # The router ID for the OSPF protocol on the switch.
   network 172.16.0.0 0.15.255.255 area 0                # Advertise the on-premises network CIDR block.
   network 192.168.100.0 0.0.0.4 area 1                  # Advertise the CIDR block of the interface that connects the switch to the SAG device.
   network 192.168.100.3 0.0.0.0 area 0                  # Advertise the switch's own loopback address. 
   area 1 nssa                                           # The OSPF area must be configured as an NSSA.
                   

2. Configure routing on the egress router.

   
   ip route 192.168.100.0 255.255.255.252 192.168.80.2    # The route from the egress router to the SAG device.
                   

Step 5: Configure the cloud network connection

After configuring the device, set up the cloud network connection to bridge your on-premises network and Alibaba Cloud.

1. Create a Cloud Connect Network (CCN) instance.

   1. Log on to the Smart Access Gateway console.

   2. In the top navigation bar, select the Mainland China region.

      The CCN and SAG device must be in the same region.

   3. In the left-side navigation pane, click CCN.

   4. On the CCN page, click Create CCN Instance.

   5. On the Create CCN Instance page, enter a name for the CCN instance, and then click OK.

      After the CCN instance is created, it appears in the instance list.

2. Bind the SAG instance to the CCN instance.

   1. In the left-side navigation pane, click Smart Access Gateway.

   2. On the Smart Access Gateway page, click Network Configuration in the Operation column of the target instance.

   3. In the left-side navigation pane, click Network Instance Details.

   4. On the Network Instance Details tab, click Add Network, select Bind CCN, choose the CCN instance you created, and then click OK.

3. Bind the CCN instance to a CEN instance.

   Binding CCN to CEN allows the SAG device in the CCN instance to communicate with the VPC attached to the CEN instance.

   1. In the left-side navigation pane, click CCN.

   2. Find the target CCN instance and click Bind CEN Instance in the Operation column.

   3. On the Bind CEN Instance page, click Existing CEN, choose your CEN instance, and then click OK.

4. Configure security group rules.

   Configure a security group rule for the ECS instance in your VPC to allow traffic from the on-premises CIDR block 172.16.0.0/12. For more information, see Add a security group rule.

Step 6: Test connectivity

After you complete the configurations, access VPC resources from an on-premises client to verify connectivity.